Python: Make exception info concept local

python/ql/test/query-tests/Security/CWE-209/ExceptionInfo.ql

@@ -0,0 +1,20 @@
+import python
+import semmle.python.dataflow.new.DataFlow
+import TestUtilities.InlineExpectationsTest
+import semmle.python.security.dataflow.ExceptionInfo
+
+class ExceptionInfoTest extends InlineExpectationsTest {
+  ExceptionInfoTest() { this = "ExceptionInfoTest" }
+
+  override string getARelevantTag() { result = "exceptionInfo" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(location.getFile().getRelativePath()) and
+    exists(ExceptionInfo e |
+      location = e.getLocation() and
+      element = e.toString() and
+      value = "" and
+      tag = "exceptionInfo"
+    )
+  }
+}

python/ql/test/query-tests/Security/CWE-209/Exceptions.py

@@ -0,0 +1,10 @@
+try:
+    1+2
+except Exception as e:  #$ exceptionInfo
+    e
+
+def test_exception():
+    try:
+        1+2
+    except Exception as e:  #$ exceptionInfo
+        e

python/ql/test/query-tests/Security/CWE-209/Stacktrace.py

@@ -0,0 +1,15 @@
+import sys, traceback
+
+try:
+    1/0
+except:
+    exc_type, exc_value, exc_traceback = sys.exc_info() #$ exceptionInfo
+
+    tb = traceback.extract_tb(exc_traceback) #$ exceptionInfo
+    stack = traceback.extract_stack() #$ exceptionInfo
+    print(traceback.format_exc(1, tb)) #$ exceptionInfo
+    print(traceback.format_exception(exc_type, exc_value, exc_traceback)) #$ exceptionInfo
+    print(traceback.format_exception_only(None, exc_value)) #$ exceptionInfo
+    print(traceback.format_list(stack)) #$ exceptionInfo
+    print(traceback.format_stack()) #$ exceptionInfo
+    print(traceback.format_tb(exc_traceback)) #$ exceptionInfo

python/ql/test/query-tests/Security/CWE-209/test.py

@@ -12,16 +12,16 @@ def do_computation():
 def server_bad():
     try:
         do_computation()
-    except Exception as e:
-        return traceback.format_exc()
+    except Exception as e:  #$ exceptionInfo
+        return traceback.format_exc()  #$ exceptionInfo
 
 # GOOD
 @app.route('/good')
 def server_good():
     try:
         do_computation()
-    except Exception as e:
-        log(traceback.format_exc())
+    except Exception as e:  #$ exceptionInfo
+        log(traceback.format_exc())  #$ exceptionInfo
         return "An internal error has occurred!"
 
 #BAD
@@ -29,8 +29,8 @@ def server_good():
 def server_bad_flow():
     try:
         do_computation()
-    except Exception as e:
-        err = traceback.format_exc()
+    except Exception as e:  #$ exceptionInfo
+        err = traceback.format_exc()  #$ exceptionInfo
         return format_error(err)
 
 def format_error(msg):